0

I have a production VSTO Add-In that is deployed using ClickOnce. For most of my customers, the installation works fine and the Microsoft Office Customization Installer is able to pick up my company as the publisher like so:

enter image description here

But for some reason, on some computers, the publisher is shown as "Unknown Publisher", like this:

enter image description here

I've tried manually installing our certificate to the user's trusted publishers store, installing the intermediate cert, and the trusted root cert, but in some instances the installer STILL shows "Unknown Publisher". This is extremely frustrating because some of our clients have security policies require Office Add-Ins to be signed by a trusted publisher, and our add-in will not load even after they click install. Instead they are presented with this lovely message:

enter image description here

Here are some details about my add-in project properties:

  • Project is built on .NET Framework 4.6.1
  • I have a valid certificate issued from Sectigo
  • The certificate is installed in my personal certificates store
  • I've chosen to sign the ClickOnce manifest and pointed it to my certificate

enter image description here

Any idea what causes this on certain machines, and how to fix it?

Note - Some of the machines that are experiencing this issue are in "closed areas" (no outside internet connection). Not sure if that makes a difference or not.

Kenny Arnold
  • 406
  • 2
  • 8
  • There is a similar question already here https://stackoverflow.com/questions/10514576/unknown-publisher-still-appears-on-correctly-code-signed-vsto-addin-built-with-v. – Pepe N O Oct 04 '21 at 14:26

2 Answers2

0

even if the question is surely already answered. The solution that work pretty well for me is to simply right click the setup.exe and go to the properties, digital signatures to install the certificat to your trusted root authorities.

Ximaze C
  • 138
  • 10
0

If you encounter the "Unknown Publisher" message it can also indicate that the end-user is blocking the certificate certificate revocation list (CRL) URL. IF the CRL can not be access, Windows can not tell weather the certificate should be invalidated and asks the user for confirmation. You can find the specific CRL link by opening your certificate and looking trough the properties.

SmugMug
  • 1